# SaaS Stack & Email Provider Detector: M365, Okta, HubSpot (`centorprat/saas-stack-email-provider-detector`) Actor

From a company domain or work email, names its email provider (Microsoft 365, Google Workspace), security gateway, MS tenant, DMARC, sending tools, SSO and the SaaS it verified (Atlassian, Okta, Zoom, OpenAI...) - all from public DNS.

- **URL**: https://apify.com/centorprat/saas-stack-email-provider-detector.md
- **Developed by:** [Centor Prat](https://apify.com/centorprat) (community)
- **Categories:** Lead generation, Developer tools
- **Stats:** 1 total users, 0 monthly users, 0.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $4.25 / 1,000 domain profileds

This Actor is paid per event and usage. You are charged both the fixed price for specific events and for Apify platform usage.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## SaaS Stack & Email Provider Detector: M365, Okta, HubSpot

**Give a company domain (or a work email) and see the SaaS it runs, read from its public DNS.** You get the
email provider (Microsoft 365, Google Workspace, Zoho...), the email security gateway in front of it
(Proofpoint, Mimecast, Barracuda...), the Microsoft 365 tenant name, DMARC policy and reporting vendor, every
service allowed to send email as the domain (HubSpot, Marketo, Salesforce, SendGrid, Zendesk...), the SaaS its
admins verified (Atlassian, DocuSign, Okta, Zoom, Slack, Adobe, OpenAI, Anthropic, Stripe...), and the vendors
behind standard subdomains (help → Zendesk, status → Statuspage, careers → Greenhouse, go → Marketo,
login → Okta, www → Webflow / WP Engine).

**Why DNS:** website tech detectors only see what loads on the homepage. A company's internal stack (email,
security, identity, collaboration, AI tools, HR and recruiting) never appears there, but it leaves records in
DNS. It's read-only DNS-over-HTTPS, so nothing is sent to the company. A domain takes 1-3 seconds.

### 📋 What you get (per company)

| Field | What it is |
|---|---|
| `emailProvider` | Microsoft 365, Google Workspace, Zoho, Proton, Fastmail, GoDaddy, Rackspace... Inferred even behind a gateway ("Microsoft 365 (behind Proofpoint)") |
| `emailSecurityGateway` | Proofpoint, Mimecast, Barracuda, Cisco IronPort, Broadcom/Symantec, Trend Micro, Sophos, Trellix, Hornetsecurity... |
| `microsoftTenant` | The `*.onmicrosoft.com` tenant name, when DKIM reveals it |
| `dmarc` | Policy (`none` / `quarantine` / `reject`) and reporting vendor (Valimail, dmarcian, Proofpoint EFD, Red Sift, EasyDMARC...) |
| `vendors` | Every detected vendor: `name`, `category`, `evidence` (the exact record), `confidence` |
| `stack` | Vendors grouped: productivity, emailSecurity, identity, collaboration, ai, marketingAutomation, crm, emailSending, support, recruiting, hr, devTools, security, hosting, website, payments, eSignature... |
| `verificationRecords` | SaaS with a domain-verification TXT record (admin-level adoption) |
| `subdomains` | help / status / docs / careers / go / login / www... with their CNAME and vendor |
| `dkimSelectors` | DKIM selectors found (confirmed sending services) |
| `dnsProvider` | Cloudflare, Route 53, Azure DNS, GoDaddy, MarkMonitor / CSC (corporate registrars)... |
| `itMaturity` | basic / standard / advanced, from security gateway, SSO, DMARC enforcement and security tools |
| `signals` | Sales-ready one-liners: "Email on Microsoft 365 (behind Proofpoint)", "No DMARC record", "SSO: Okta", "AI tools verified: OpenAI, Anthropic" |

### 📥 Input

| Field | What it does |
|---|---|
| `domains` | Company domains or websites, e.g. `["stripe.com", "atlassian.com"]` |
| `emails` | Work emails. The domain is taken from each address, and free-mail addresses (gmail.com, outlook.com...) are skipped for free |
| `datasetId` | Any dataset with a domain / website / url / email / companyDomain field (CRM export, LinkedIn or Maps scraper run...) |
| `emailProvider` | Keep only `microsoft`, `google` or `other` |
| `requireVendors` | Keep companies using any of these, e.g. `["Okta"]`, `["Proofpoint", "Mimecast"]` |
| `excludeVendors` | Drop companies using any of these (e.g. your own product) |
| `includeSubdomains` | Return the vendor-hosted subdomain list (default on) |

**Example: which of my leads are on Microsoft 365?**

```json
{ "emails": ["jane@acme.com", "bob@initech.com", "sue@globex.com"], "emailProvider": "microsoft" }
```

**Example: companies behind Proofpoint or Mimecast (email-security displacement)**

```json
{ "datasetId": "<your company list>", "requireVendors": ["Proofpoint", "Mimecast"] }
```

### 📤 Output (one row per company, shortened)

```json
{
  "domain": "stripe.com",
  "emailProvider": "Google Workspace",
  "emailSecurityGateway": null,
  "dmarc": {"policy": "reject", "reportingVendor": null},
  "vendorsCount": 21,
  "vendors": [
    {"name": "Anthropic (Claude for Work)", "category": "ai", "confidence": "high",
     "evidence": ["TXT anthropic-domain-verification-zk7x9c=QfN52ECybLPUWh51R9pKF0Q"]},
    {"name": "Qualtrics", "category": "analytics", "confidence": "high", "evidence": ["SPF include:_spf.qualtrics.com"]},
    {"name": "SendGrid (Twilio)", "category": "emailSending", "confidence": "high",
     "evidence": ["DKIM s1._domainkey -> s1.domainkey.u2342.wl.sendgrid.net"]}
  ],
  "stack": {
    "ai": ["OpenAI (ChatGPT Enterprise / API)", "Anthropic (Claude for Work)"],
    "collaboration": ["Atlassian (Jira / Confluence)", "Whimsical"],
    "support": ["Zendesk", "Intercom"],
    "emailSending": ["SendGrid (Twilio)", "Mailchimp Mandrill"],
    "eSignature": ["DocuSign"],
    "hosting": ["Vercel", "Fastly"]
  },
  "dnsProvider": "Amazon Route 53",
  "itMaturity": "standard",
  "signals": ["Email on Google Workspace", "AI tools verified: OpenAI (ChatGPT Enterprise / API), Anthropic (Claude for Work)"]
}
```

A Microsoft 365 company also shows its tenant, for example `"microsoftTenant": "deathwishcoffee"` and
`"emailProvider": "Microsoft 365 (behind Barracuda)"`.

### 💰 Pricing (pay-per-event)

- **Domain profiled: $0.005** per company domain that resolves ($5 per 1,000).
- Free: free-mail addresses, non-existent domains and failed lookups.
- Vendor and provider filters run after the lookup, so every resolved domain is billed.

### 💡 Use cases

- **MSPs and IT resellers:** find Google Workspace companies to migrate (or the reverse), and companies with
  no email security gateway or no DMARC.
- **Email security and DMARC vendors:** displacement lists (on Proofpoint, Mimecast, Barracuda), and domains
  with no DMARC or `p=none`.
- **B2B SaaS sales:** who runs Okta, HubSpot vs Marketo vs Pardot, Zendesk vs Intercom, Greenhouse vs Lever,
  and who has already verified OpenAI or Anthropic (AI-adoption signal).
- **Lead enrichment:** turn a list of work emails into each company's stack in one pass.
- **Security research and vendor due diligence:** a company's third-party SaaS footprint from public records.

### 🚀 Ready-made tasks

- [Microsoft 365 or Google Workspace? (Email Provider Lookup)](https://apify.com/centorprat/saas-stack-email-provider-detector/examples/microsoft-365-or-google-workspace-lookup)
- [Email Security Gateway Detector (Proofpoint, Mimecast)](https://apify.com/centorprat/saas-stack-email-provider-detector/examples/email-security-gateway-detector)
- [Company SaaS Stack from Work Emails](https://apify.com/centorprat/saas-stack-email-provider-detector/examples/company-saas-stack-from-emails)

### 🔌 API, Standby and agents

**Instant lookup (Standby):**

```bash
curl "https://centorprat--saas-stack-email-provider-detector.apify.actor/?domain=stripe.com&token=<YOUR_APIFY_TOKEN>"
curl "https://centorprat--saas-stack-email-provider-detector.apify.actor/?emails=jane@acme.com&includeSubdomains=false&token=<YOUR_APIFY_TOKEN>"
```

**Python**

```python
from apify_client import ApifyClient
client = ApifyClient("<YOUR_APIFY_TOKEN>")
run = client.actor("centorprat/saas-stack-email-provider-detector").call(run_input={"domains": ["stripe.com"]})
for c in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(c["domain"], c["emailProvider"], c["stack"].get("identity"), c["signals"])
```

**MCP**

```json
{
  "mcpServers": {
    "apify": {
      "url": "https://mcp.apify.com/?tools=actors,docs,centorprat/saas-stack-email-provider-detector"
    }
  }
}
```

**Claude Code:** `claude mcp add --transport http apify "https://mcp.apify.com/?tools=actors,docs,centorprat/saas-stack-email-provider-detector" --header "Authorization: Bearer <YOUR_APIFY_TOKEN>"`

### ❓ FAQ

**Is a verification record proof that the company uses the tool?** It's proof that an admin verified the domain
with that vendor, usually to set up SSO, a team or an enterprise workspace. It's a strong adoption signal; the
`evidence` field shows the exact record.

**How is the email provider found behind a gateway?** The MX points to the gateway (Proofpoint, Mimecast...), so
the mailbox provider is inferred from SPF includes, Microsoft verification and DKIM records, and Exchange
autodiscover.

**What about wildcard DNS?** Some domains answer every name. The Actor probes a random name first and ignores
results that only match the wildcard (`wildcardDns: true`).

**Does it contact the company?** No. Every query goes to public DNS-over-HTTPS resolvers (Google, Cloudflare
fallback). Nothing is sent to the company's servers.

**How fast?** About 1-3 seconds per domain, 6 in parallel by default.

**Is it legal?** It reads public DNS records, the same data any mail server reads when it receives an email.

### 📜 Data & attribution

Public DNS only, via DNS-over-HTTPS. Vendor names are trademarks of their owners and are reported only as
detected DNS records.

### 🔗 Related actors

- [Domain Lookup API - DNS, MX, SPF, Tech & Contact Emails](https://apify.com/centorprat/domain-lookup-dns-mx-email): DNS + live homepage → IPs, MX/SPF, tech, socials and public contacts per domain.
- [Shopify App Detector: Tech Stack, Pixels & Theme](https://apify.com/centorprat/shopify-app-detector): every app a Shopify store runs, with evidence, estimated app spend and change tracking.
- [Company Hiring Monitor](https://apify.com/centorprat/company-hiring-monitor): every open role from a company's own careers board, with hiring trends.

# Actor input Schema

## `domains` (type: `array`):

Company domains or websites, e.g. \["stripe.com", "atlassian.com"].

## `emails` (type: `array`):

Lead or contact emails, e.g. \["jane@acme.com"]. The company domain is taken from each address; free-mail addresses (gmail.com, outlook.com, yahoo.com...) are skipped for free.

## `datasetId` (type: `string`):

Pick any dataset whose rows have a domain, website, url, email, companyDomain or companyWebsite field (a CRM export, a LinkedIn or Google Maps scraper run...). Read-only.

## `emailProvider` (type: `string`):

microsoft = Microsoft 365 (incl. via GoDaddy), google = Google Workspace, other = neither, any = no filter.

## `requireVendors` (type: `array`):

e.g. \["Okta"], \["Proofpoint", "Mimecast"], \["HubSpot"], \["Greenhouse"]. Case-insensitive.

## `excludeVendors` (type: `array`):

e.g. your own product, to keep only prospects.

## `includeSubdomains` (type: `boolean`):

Return each vendor-hosted subdomain with its CNAME (help, status, careers, go, login, www...). Turn off for smaller rows.

## `maxItems` (type: `integer`):

Safety cap when reading a dataset.

## `concurrency` (type: `integer`):

How many domains are looked up at once.

## `webhookUrl` (type: `string`):

If set, the results are POSTed here as JSON.

## Actor input object example

```json
{
  "domains": [
    "stripe.com",
    "atlassian.com",
    "deathwishcoffee.com"
  ],
  "emailProvider": "any",
  "includeSubdomains": true,
  "maxItems": 2000,
  "concurrency": 6
}
```

# Actor output Schema

## `companies` (type: `string`):

One row per company domain: email provider, email security gateway, Microsoft tenant, DMARC policy and reporting vendor, every detected vendor (name, category, evidence), the stack grouped by category, verification records, DKIM selectors, vendor-hosted subdomains, DNS provider, IT maturity and sales signals.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "stripe.com",
        "atlassian.com",
        "deathwishcoffee.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("centorprat/saas-stack-email-provider-detector").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "domains": [
        "stripe.com",
        "atlassian.com",
        "deathwishcoffee.com",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("centorprat/saas-stack-email-provider-detector").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "stripe.com",
    "atlassian.com",
    "deathwishcoffee.com"
  ]
}' |
apify call centorprat/saas-stack-email-provider-detector --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,centorprat/saas-stack-email-provider-detector"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/yxf66VS6v2gPgIfLe/builds/L1uQ4kCgD5iZaJ6FI/openapi.json